Nov. 6, 2020: National Advocacy Update

The Federal Bureau of Investigation (FBI) and two federal agencies are warning of an "imminent cybercrime threat" to U.S. hospitals and health care providers, noting that several hospitals across the country have already been hit. In a joint advisory, the Cybersecurity and Infrastructure Security Agency (CISA), FBI and the U.S. Department of Health and Human Services (HHS) said they have "credible information" that cybercriminals are taking new aim at health care providers and public health agencies as the COVID-19 pandemic reaches new heights.

"Malicious cyber actors" may soon be planning to "infect systems with Ryuk ransomware for financial gain" on a scale not yet seen across the American health care system. Hospitals, physician practices and public health organizations should take "timely and reasonable precautions to protect their networks from these threats." Malware targeting techniques often lead to "ransomware attacks, data theft, and the disruption of healthcare services." The agencies recommend several mitigation steps and best practices for health care entities to take to reduce their risk, including the following:

• Patch operating systems, software, and firmware as soon as manufacturers release updates.
• Regularly change passwords to network systems and accounts and avoid reusing passwords for different accounts.
• Use multi-factor authentication where possible.     •   Disallow use of personal email accounts.
• Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
• Identify critical assets; create backups of these systems and house the backups offline from the network.
• Set antivirus and anti-malware solutions to automatically update; conduct regular scans.

The AMA and the American Hospital Association (AHA) have created two resources to help physicians and hospitals guard against cyber threats. Those resources and additional cyber security information can be found at the AMA's cybersecurity webpage.

On Nov. 2, the AMA submitted comments on the Centers for Medicare & Medicaid Services (CMS) Medicare Coverage of Innovative Technology (MCIT) proposed rule. The rule proposes a new coverage pathway for medical devices approved with a breakthrough designation from the Food and Drug Administration (FDA). The new pathway, if finalized, would provide technologies approved with a breakthrough designation immediate Medicare coverage for a period of four years, providing that the technology has a Medicare benefit category. After the initial coverage period, technologies would be required to pursue one of the traditional pathways for Medicare coverage. The rule also proposed changes to the definition of "reasonable and necessary" for purposes of Medicare coverage and would allow CMS to consider private payor coverage policies in determining whether an item or service meets the definition. The AMA is supportive of ensuring payment and coverage or emerging technologies for Medicare beneficiaries and supports efforts to lessen the burdens of this process. However, the proposed rule raised some concerns about immediate coverage of technologies with comparatively less safety, efficacy and outcomes data than a device approved through traditional clearance or approval pathways. The AMA also raised concern about the lack of opportunity for stakeholder review and input about these coverage decisions. The AMA also noted concern about allowing private payor coverage policy to determine whether an item is "reasonable and necessary" for purposes of Medicare coverage.

On Oct. 29, the Trump Administration finalized the second of its efforts at ensuring price transparency for health care services. The Transparency in Coverage final rule, which applies to private health insurers, creates new mandates for disclosure of pricing and other benefit information to plan participants. The rule requires health insurers to make available to their insured patients an internet-based self-service tool that will provide individuals with information about their cost-sharing obligations for requested services and procedures. Additionally, the tool will provide information about accrued amounts applied towards deductibles, and any prerequisites for coverage. The tool must be available with pricing information on 500 pre-specified "shoppable" services starting Jan. 1, 2023, and for all covered items and services by Jan. 1, 2024. In addition to the patient self-service tool, the final rule mandates public disclosure of three types of payment information: payment rates negotiated with providers, out-of-network allowable amounts and prescription drug pricing information. This information must be publicly available starting Jan. 1, 2022.  The AMA submitted detailed comments on the proposed rule earlier this year. In its comments, the AMA strongly supported efforts to ensure patient access to estimated out-of-pocket cost and benefit information. However, the AMA strongly opposed efforts to require public disclosure of physician negotiated rate information, citing a number of concerns about the impact on competition and ultimately of the impacts on access to care. The Administration finalized a similar rule applicable to hospitals earlier in 2020. Hospital groups have mounted legal challenges to these new regulations but have not prevailed at this time. 

The Office of the National Coordinator for Health IT (ONC) announced it is extending compliance deadlines for certain information blocking and health IT certification requirements. Originally, ONC's Information Blocking Rule required all Actors—including physicians and hospitals—to come into compliance with information blocking requirements by Nov. 2, 2020. Responding to the AMA's advocacy efforts requesting additional time and flexibility due to the COVID-19 pandemic, ONC's interim final rule now pushes the information blocking compliance date to April 5, 2021. In anticipation of physician compliance with ONC's information blocking rule, the AMA has created a two-part educational resource. Part 1 outlines what information blocking is, key terms to know, examples of information blocking practices, and a summary of exceptions for when physicians may restrict access, exchange and use of electronic health information. Part 2 will help physicians start down the path of compliance, including questions to consider, considerations for maintaining a compliance program and next steps. The AMA will continue to update these resources as the federal government releases new guidance.  

On Oct. 28, CMS issued a fourth COVID-19 Interim Final Rule with Comment, which provides coverage and payment details for COVID-19 vaccines and therapeutics. Medicare will cover the cost of COVID-19 vaccines and their administration and will waive out-of-pocket costs for both traditional fee-for-service beneficiaries and beneficiaries enrolled in Medicare Advantage plans. Medicare will pay physicians $28.39 to administer coronavirus vaccines. For vaccines that require two doses, Medicare will pay $16.95 for the first dose and $28.39 for the second dose. The AMA is carefully analyzing these payment rules and has early concerns about a lower payment rate for initial vaccine doses. The rule also requires Medicaid, Children's Health Insurance Program agencies and most private health plans to administer the vaccine at no cost to patients during the public health emergency. The Department of Health and Human Services will cover the vaccine and its administration for any uninsured individuals through the CARES Act Provider Relief Fund. The press release announcing the rule acknowledges, "CMS and the American Medical Association (AMA) are working collaboratively on finalizing a new approach to report use of COVID-19 vaccines, which include separate vaccine-specific codes.  Providers and insurance companies will be able to use these to bill for and track vaccinations for the different vaccines that are provided to their enrollees." The CPT Editorial Panel is anticipated to vote on COVID-19 vaccine codes during a special meeting this week, and the AMA/Specialty Society Relative Value Scale Update Committee (RUC) may consider recommendations about any approved codes. Additional notable provisions in the interim final rule include:

• Physicians and other health care professionals who perform COVID-19 diagnostic tests must post their cash prices online via their website.
• CMS will pay hospitals add-on payments in the inpatient and outpatient settings for COVID-19 therapeutics.
• CMS also extends for six months the Comprehensive Care for Joint Replacement (CJR) model, which will now end on Sept. 30, 2021.

The rules are effective immediately and comments are due on Jan. 4, 2021. CMS released additional information including a fact sheet, COVID-19 vaccine resources and FAQs on billing for therapeutics.

On Oct. 29, 36 bipartisan members of Congress sent a letter to Acting Secretary of the Department of Homeland Security (DHS), Chad Wolf, in opposition to a proposed regulation that eliminates the current "duration of status" system as an authorized period of stay for J-1 international medical graduates. In addition to questioning the underlying need for the Sept. 25 regulation and highlighting how it prevents foreign medical graduates from timely completion of their residency, the letter cautions that the potential changes to duration of status will severely disrupt the pipeline of physicians into the highly successful Conrad 30 program.  The AMA worked in conjunction with Representatives Brad Schneider (D-IL), Abby Finkenauer (D-IA), and David McKinley (R-WV) to spearhead the letter and secure bipartisan cosigners.    The Educational Commission for Foreign Medical Graduates (ECFMG) is the sole Department of State sponsor for foreign national physicians participating in residencies and fellowships in the United States under J-1 visas.  The approximately 12,000 J-1 international medical graduates serving patients at nearly 750 teaching hospitals in more than 50 medical specialties and subspecialties play a key role in American health care, especially in rural and underserved communities.  Under the current system, physicians on J-1 visas are admitted to the United States for the length of their training program and are required to annually renew their contracts via ECFMG for the duration of their residency.  Under the proposed DHS rule, the annual visa renewal would require an additional step, specifically applying separately for an extension through the US Customs and Immigration Services (USCIS) via the completion of Form I-539 Application to Extend/Change Nonimmigrant Status.  The processing time for the I-539, however, can last anywhere from 5 to 19 months, a completely unworkable timeline due to the fact that residents typically receive their contract renewals only 3 to 5 months prior to the July 1 start date for each additional academic year. In addition, changes to the duration of status system will prevent a seamless transition for select J-1 physicians into the Conrad 30 program.  J-1 physicians are currently required to return to their country of origin for two years immediately after completing their residency before they can apply for another US visa or green card.  Under the Conrad 30 program, every state receives a select number of waivers that allow J-1 physicians to remain in the United States without having to return to their home country if they agree to practice in an underserved area for three years.  Since changes to the duration of status system will prevent J-1 physicians from completing their residency, the seamless transition for international medical graduates to the Conrad 30 program will be severed.  The AMA applauds Reps. Schneider, Finkenauer, and McKinley for urging DHS to exempt J-1 physicians from these harmful changes to duration of status.

• Nov. 6, 2020: State Advocacy Update